npm --version
# should give you v3.10.10 or above (does not work with v1 or v2, and there's a bug in v3.10.8-9)
npm i --no-optional package@major.minor.patch --save(-dev)
npm shrinkwrap --dev
# git review

Now everyone's happy and the patch got merged. Go to the deploy repo and: